When i scan my system with tripwire and try to update after with
tripwire --update -Z low
i get the error:
### Error: File could not be opened.
### Filename: /var/lib/tripwire/report/nesystem-20101217-212722.twr
### No such file or directory
### Exiting...
What's the reason?
tripwire --update requires a particular (usually the most recent) tripwire output file to operate on. When you last ran tripwire --check it will have created a report file; if you want to update from that, find the name of that report file (usually the most recent creation in /var/lib/tripwire/report) and do
tripwire --update -Z low -r /var/lib/tripwire/report/THATFILE
If you're using the most recent tripwire output file, -Z low is often not required, and I think it's generally a good idea to omit it: if there have been any further changes since the report was generated, you want to know about them, and resolve them manually.
If you must have a fast workaround, you could put something like this in your .bashrc file (assuming you're using bash):
alias triplast="tripwire --update -r `ls -1rt /var/lib/tripwire/report|tail -1`"
which will run tripwire in update mode on the most recent entry in the reports directory.
